| Description:
|
Details
BachKhoa.3999
This is a very dangerous memory resident encrypted parasitic virus. It uses anti-debugging tricks in its code. When an infected file is executed, the virus hooks INT 21h, stays memory resident and then writes itself to the end of COM and EXE files that are accessed.
The virus deletes the anti-virus and other data files: CHKLIST.MS, CHKLIST.CPS, FILESIGN.SAV, FILE_ID.DIZ. On November 25 it also erases the hard drive sectors. It contains the text strings:
Ha Noi University of technology
Your PC was infected by BACH KHOA virus version 1.5 |
